security(skills): warn when safety metadata is unavailable

Add MetadataAvailable flag to InstallResult. When the registry
metadata fetch fails (silent fallback), the user now sees a
warning that safety checks could not be completed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pkg/skills/clawhub_registry.go

@@ -248,6 +248,7 @@ func (c *ClawHubRegistry) DownloadAndInstall(
 		result.IsMalwareBlocked = meta.IsMalwareBlocked
 		result.IsSuspicious = meta.IsSuspicious
 		result.Summary = meta.Summary
+		result.MetadataAvailable = true
 	}
 
 	// Step 2: Resolve version.

pkg/skills/registry.go

@@ -40,6 +40,7 @@ type InstallResult struct {
 	IsMalwareBlocked  bool
 	IsSuspicious      bool
 	Summary           string
+	MetadataAvailable bool
 }
 
 // SkillRegistry is the interface that all skill registries must implement.

pkg/tools/skills_install.go

@@ -159,10 +159,13 @@ func (t *InstallSkillTool) Execute(ctx context.Context, args map[string]any) *To
 		_ = err
 	}
 
-	// Build result with moderation warning if suspicious.
+	// Build result with moderation warnings.
 	var output string
+	if !result.MetadataAvailable {
+		output += fmt.Sprintf("Warning: safety metadata was not available for skill %q. Exercise caution.\n\n", slug)
+	}
 	if result.IsSuspicious {
-		output = fmt.Sprintf("⚠️ Warning: skill %q is flagged as suspicious (may contain risky patterns).\n\n", slug)
+		output += fmt.Sprintf("⚠️ Warning: skill %q is flagged as suspicious (may contain risky patterns).\n\n", slug)
 	}
 	output += fmt.Sprintf("Successfully installed skill %q v%s from %s registry.\nLocation: %s\n",
 		slug, result.Version, registry.Name(), targetDir)